Corrective releases of the Ruby programming language 3.3.13, 3.4.12 and 4.0.9 have been published, which eliminate a critical vulnerability (CVE-2026-110264), leading to integer overflow when compiled specifically formatted regular expressions. The vulnerability can be used to attack projects written in the Ruby language and using external data in regular expressions. Among other things, the possibility of exploiting a vulnerability for remote code execution in a collaborative development platform has been confirmed GitLab. The issue is additionally fixed in updates GitLab 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. The vulnerability is assigned a severity level of 10 out of 10.
The vulnerability is present in the regular expression engine Onigmo and leads to an overflow of internal identifiers when compiling a template with a large number repetitions The problem only appears in applications that use external data in regular expressions processed through the Regexp.new, Regexp.union and Regexp.compile methods or literals of the form “/#{input}/”. Limiting the size of a regular expression or its processing time through the Regexp.timeout method blocks the vulnerability, since short patterns can be used for the attack.
In GitLab, the vulnerability can be exploited by an unauthenticated user due to the substitution of external data into the regular expression. Details of the exploitation method have not yet been disclosed (according to GitLab rules, information becomes available 30 days after the patch is published), while attempts to carry out attacks on GitLab users have already been recorded on the network. Indirect signs of an attack can be increase in the number of crashes of the Ruby interpreter and increase of errors in the logs associated with the expiration of the page rendering timeout during processing … template).